GoKawiilFirezone open-sources sanstun, a sans-IO WireGuard implementation in Rust
Firezone has released sanstun, a Rust implementation of the WireGuard state machine built using the sans-IO design pattern, which separates network IO, time handling and randomness from core logic. The company says it developed sanstun after years of patching boringtun, its previous WireGuard dependency, to meet evolving product needs while trying to maintain API compatibility upstream.
GoKawiil's interpretation of the reporting above, not reported fact.
Separating side effects from state logic can make networking code easier to test and simulate, and could help other Rust projects building VPN or tunneling tools avoid similar maintenance burdens Firezone describes facing with boringtun. The move suggests Firezone sees enough limitations in existing WireGuard libraries to justify maintaining its own implementation rather than continuing to fork an existing one.
- Firezone released sanstun, a new sans-IO WireGuard implementation written in Rust.
- The design separates IO, time and randomness from core protocol logic to ease testing and composition.
- Firezone built it after struggling to maintain compatibility while patching boringtun, its prior dependency.
Source: firezone.dev, 2026-10-30
Published there as: “Sanstun: A sans-IO, parallel-friendly WireGuard implementation in Rust”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.